Pyload Ng Project maintains a download manager and media retrieval application that, despite a narrow product footprint, ranks among the more prominent entities in the vulnerability landscape. The vendor's disclosures cluster around a single product, Pyload Ng, which serves as a personal file-handling and automation tool deployed across diverse user environments. The recurring exposure pattern does not point to a dominant structural weakness class, suggesting a distributed vulnerability surface rather than a concentrated architectural flaw. Defenders treating this vendor should approach advisories as targeted to the application itself rather than as a systemic supply-chain issue; live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Pyload Ng Project over time
Signals from CVEs in this vendor scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-42313HIGH pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api | May 11, 2026 | 8.3 | 32 | NO | NO |
CVE-2025-54802CRITICAL pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Bluepri | Aug 5, 2025 | 9.8 | 32 | NO | NO |
CVE-2026-33509HIGH pyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API endpoint allows users with the n | Mar 24, 2026 | 8.8 | 31 | NO | NO |
CVE-2026-35463HIGH pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts security-critical configura | Apr 7, 2026 | 8.8 | 30 | NO | NO |
CVE-2026-35459CRITICAL pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-20 | Apr 6, 2026 | 9.1 | 30 | NO | NO |
CVE-2026-33511CRITICAL pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature c | Mar 24, 2026 | 9.8 | 29 | NO | NO |
CVE-2026-42315MEDIUM pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function call inside the data | May 11, 2026 | 6.5 | 28 | NO | NO |
CVE-2024-22416HIGH pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to | Jan 18, 2024 | 8.8 | 28 | NO | NO |
CVE-2026-42312MEDIUM pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api | May 11, 2026 | 6.8 | 27 | NO | NO |
CVE-2026-32808HIGH pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypte | Mar 20, 2026 | 8.1 | 27 | NO | NO |
Signals from CVEs in this vendor scope (20 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Pyload Ng Project.
Media articles that mention a CVE ID that affects a product developed by Pyload Ng Project — matched by CVE ID, not by vendor name.